Enclosure No. 2.B.- Appendix B Statement of Work 01-28-26.docx.docx

Appendix “B” Argonne National Laboratory Statement of Work for Integration Strategy for Requirements, Records, Documents, and Data Project January 28, 2026

1.0 Background

Argonne National Laboratory (Argonne), a U.S. Department of Energy (DOE) national laboratory, must comply with applicable laws and tens of thousands of contractually mandated requirements, including regulations, clauses, standards, and DOE Directives identified or invoked by Argonne’s Prime Contract with DOE. These requirements are currently assigned to and implemented through Argonne's 12 core management processes, aligned with ISO 9001:2015(E). The contractor shall help Argonne construct and present a modernized, integrated compliance management vision that, when implemented, will:

· Prevent gaps in oversight and eliminate silos of information

· Enable efficient and effective responses when requirements change

· Provide consistent management of compliance-based work processes

· Create discoverable information assets for Laboratory leadership

· Integrate with Argonne's Enterprise Data Warehouse

· Position Argonne for future expansion into broader governance and enterprise risk management capabilities The purpose of this engagement is for the Laboratory to assess options regarding commercial-off-the-shelf (COTS) Enterprise Compliance Management System (ECMS) solutions and evaluate current business applications at Argonne for the creation of an integrated system to manage Governance, Risk, and Compliance (GRC) platforms, and produce a set of recommendations and a roadmap for planning the potential future implementation of a solution that will serve as Argonne’s authoritative system of record for requirements management and contract compliance. This engagement is limited to assessment, analysis, and planning activities only. No system implementation, configuration, deployment, testing, training, or operational support is included under this contract.

2.0 Scope The contractor will assess options regarding commercial-off-the-shelf (COTS) Enterprise Compliance Management System (ECMS) solutions and evaluate current business applications at Argonne for the creation of an integrated system to manage Governance, Risk, and Compliance (GRC) platforms, and provide the Laboratory with a set of recommendations and a roadmap for implementing a solution that will serve as the Laboratory's authoritative system of record for requirements management and contract compliance.

3.0 Objectives

· Evaluate leading commercial products that separately, or in combination, manage enterprise compliance processes related to areas such as records, documents, workflows, compliance, and risk.

· Recommend the best-fit solution based on organizational needs and compliance objectives.

· Develop an implementation roadmap, ensuring seamless integration with existing applications.

4.0 Tasks

The contractor shall perform the following tasks and activities as part of this project:

4.1 Review Argonne’s Current State

· Review existing tools, systems, and manual processes used for tracking federal regulations, contract clauses, DOE Directives, and Argonne-specific policies and procedural documentation.

· Review current document management and records management practices as they relate to support of compliance-related tasks.

· Review existing governance and risk management practices that may inform or integrate with future compliance management capabilities.

· Review identified gaps, inefficiencies, and risks in the current applications or integrations that enable or demonstrate compliance.

4.2 Review Requirements and Stakeholder Alignment

· Review and validate existing functional requirements, stakeholder assessment results, and business process outputs already produced. Engage stakeholders only as needed to confirm technical integration assumptions, implementation constraints, and sequencing. The intent is to avoid re-performing earlier assessment work and instead translate existing outputs into a technically executable integration plan.

· Refine and prioritize existing functional and technical requirements specifically for technology selection, configuration, integration, and phased implementation of the future-state compliance management capability.

· Document functional and technical requirements for the future-state system, including:

· Compliance Management Capabilities:

· Change impact and conflict analysis workflows

· End-to-end traceability from contract requirements through policies, training materials, assessments, deliverables, and final records

· Regulatory change monitoring and notification

· Audit management and evidence collection

· Governance Capabilities:

· Policy lifecycle management

· Strategic alignment and accountability tracking

· Board and executive reporting

· Risk Management Capabilities:

· Enterprise risk registers and risk assessment frameworks

· Control mapping and testing

· Third-party and vendor risk management

· Incident and issue management

· Integration Requirements:

· Integration with Argonne's Enterprise Data Warehouse

· Integration with document management systems and records management systems

· Integration with authentication/authorization systems (including group and role management)

· Integration with other enterprise business applications

· Reporting, Dashboard, and Analytics Capabilities:

· Self-service reporting and ad-hoc query capabilities

· Embedded dashboards and visualizations

· Unified reporting across auditing and operational data

· Workflow and Orchestration Management:

· Automated and human-in-the-loop workflow capabilities

· Approval routing and escalation

· Task management and notifications

4.3 Review Benchmarking and Apply Best Practices

· Review existing DOE site and national laboratory benchmarking to highlight operational and technology best practices for Argonne's consideration.

· Apply industry standards and leading practices for enterprise compliance management and GRC in federally regulated environments.

· Identify relevant control frameworks and standards (e.g., NIST, ISO 31000, COSO) that may inform Argonne's future-state architecture.

4.4 Analyze Market and Engage Vendors

· Conduct a comprehensive market analysis of the Enterprise Compliance Management System (ECMS) and GRC software landscape, including:

· Pure-play compliance management solutions

· Full-suite GRC platforms with integrated governance, risk, and compliance modules

· Workflow and low-code platforms with configurable compliance capabilities

· Directly engage existing and prospective software providers who specialize in enterprise compliance management, GRC, requirements management, workflow automation, and related technologies.

· Evaluate vendor solutions against Argonne's requirements, considering:

· FedRAMP certification status and cloud capabilities

· Alignment with DOE and federal security requirements

· Integration capabilities with reporting/analytics platforms, document management systems, records management systems, and major cloud-based business application platforms

· Integration with authentication and authorization systems, including group and role management

· Workflow capabilities (both automated and human-in-the-loop)

· User administration and security features

· Licensing models, support models, and maintenance options

· Vendor stability, market position, and product roadmap

· Scalability and extensibility for future governance and risk management expansion

· Coordinate and facilitate vendor demonstrations as needed, ensuring alignment with Argonne's specified requirements.

4.5 Analyze Total Cost of Ownership

· Conduct a total cost of ownership (TCO) analysis across multiple platforms and options for Argonne's consideration, including:

· Initial licensing and implementation costs

· Annual maintenance, support, and subscription fees

· Integration and customization costs

· Training and change management costs

· Ongoing operational and administrative costs

· Costs associated with future expansion into governance and risk management modules (where applicable)

4.6 Technology Comparison and Recommendations

· Produce a technology comparison report highlighting strengths and weaknesses of alternative platforms to assist Argonne with the final decision, including:

· Functional fit against documented compliance management requirements

· Breadth and maturity of governance and risk management capabilities for future expansion

· Technical architecture and integration capabilities

· Vendor stability, market position, and relevant DOE/federal experience

· Risk assessment and mitigation considerations

· Alignment with Argonne's strategic IT direction and enterprise architecture

4.7 Implementation Roadmap and Project Planning

The activities in this section are limited to planning and documentation only and do not include execution or oversight of implementation activities.

· Draft a project plan to execute Argonne's next-generation Enterprise Compliance Management System, outlining:

· Implementation timeline and phasing approach

· Recommended phasing strategy (e.g., compliance management first, with governance and risk management in subsequent phases)

· Estimated resource considerations (internal and external)

· Key project milestones and deliverables

· Change management and training considerations

· Risk management approach

· Integration sequencing with Argonne's Enterprise Data Warehouse, document management, and records management systems

4.8 Final Assessment Report

· Draft a final assessment report complete with recommendations and next steps, summarizing all findings, analyses, and actionable guidance for Argonne leadership, including:

· Executive summary with key findings and recommendations

· Detailed current state assessment

· Requirements documentation

· Market analysis and vendor evaluation results

· Total cost of ownership comparison

· Recommended solution(s) with rationale

· Implementation roadmap and phasing strategy

· Risk considerations and mitigation strategies

· Appendices with supporting documentation

5. Deliverables The contractor shall provide the following deliverables:

6.0 Government-Owned Property

The contractor will not be assigned any government-owned property.

7.0 Security

Contractor will require access to Argonne Business Information Systems

8.0 Place of Performance

Remote, with occasional on-site visits as required.

9.0 Period of Performance

The period of performance for this assessment is anticipated to be complete by the end of fiscal year 2026 (September 2026).